@jpcasabiancai/cayenne 0.2.0 → 0.3.0

package/dist/cli.js

@@ -9,8 +9,34 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/cloud.ts
+function assertPublishable(key) {
+  if (!key) return key;
+  if (key.startsWith("sb_secret_"))
+    throw new Error("CLOUD key is a secret key; bake the publishable key");
+  if (key.startsWith("sb_publishable_")) return key;
+  const payload = key.split(".")[1];
+  if (!payload) throw new Error("CLOUD key is not a recognised Supabase key");
+  const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+  if (claims.role !== "anon") {
+    throw new Error(`CLOUD key has role "${claims.role}"; only the anon key may be baked in`);
+  }
+  return key;
+}
+var CLOUD_SUPABASE_URL, CLOUD_SUPABASE_ANON_KEY, CLOUD_APP_ORIGIN;
+var init_cloud = __esm({
+  "src/cloud.ts"() {
+    "use strict";
+    CLOUD_SUPABASE_URL = "https://ndqrkqxwkzxgnhkvcunr.supabase.co";
+    CLOUD_SUPABASE_ANON_KEY = assertPublishable(
+      "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im5kcXJrcXh3a3p4Z25oa3ZjdW5yIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODg3MTMyNzYsImV4cCI6MjEwNDI4OTI3Nn0.Dlsxw91E1QYZ4eoRDjP80Rf4feY77Z-T-fiIwUDY2k0"
+    );
+    CLOUD_APP_ORIGIN = "https://cayenne-pink.vercel.app";
+  }
+});
+
 // ../../packages/shared/src/constants.ts
-var PROTOCOL_VERSION, LOCAL_PORT, BROADCAST_MAX_BYTES, COMMAND_STALE_MS, PERMISSION_TIMEOUT_MS, HEARTBEAT_INTERVAL_MS, RUNNER_ONLINE_WINDOW_MS, TERMINAL_FLUSH_MS, TERMINAL_FLUSH_BYTES, TERMINAL_RING_BYTES, TERMINAL_INPUT_MAX_BYTES, TERMINAL_REPLAY_PART_BYTES, TERMINAL_REPLAY_MAX_PER_MINUTE, TERMINAL_MAX_PER_OWNER, TERMINAL_MAX_PER_RUNNER, TERMINAL_KILL_GRACE_MS;
+var PROTOCOL_VERSION, LOCAL_PORT, BROADCAST_MAX_BYTES, COMMAND_STALE_MS, PERMISSION_TIMEOUT_MS, HEARTBEAT_INTERVAL_MS, RUNNER_ONLINE_WINDOW_MS, TERMINAL_FLUSH_MS, TERMINAL_FLUSH_BYTES, TERMINAL_LOCAL_FLUSH_MS, TERMINAL_RING_BYTES, TERMINAL_INPUT_MAX_BYTES, TERMINAL_REPLAY_PART_BYTES, TERMINAL_REPLAY_MAX_PER_MINUTE, TERMINAL_MAX_PER_OWNER, TERMINAL_MAX_PER_RUNNER, TERMINAL_KILL_GRACE_MS, LOCAL_PORT_MIN, LOCAL_PORT_MAX, LOCAL_TOKEN_CACHE_MS, LOCAL_TOKEN_NEGATIVE_CACHE_MS, LOCAL_RECHECK_MS, LOCAL_HANDSHAKE_TIMEOUT_MS, LOCAL_MAX_FRAME_BYTES, LOCAL_MAX_PENDING_UPGRADES, LOCAL_MAX_SOCKETS_PER_USER, LOCAL_MAX_SOCKETS, LOCAL_MAX_CONNECTIONS, LOCAL_GETUSER_PER_MINUTE, LOCAL_MAX_PENDING_CMDS;
 var init_constants = __esm({
   "../../packages/shared/src/constants.ts"() {
     "use strict";
@@ -23,6 +49,7 @@ var init_constants = __esm({
     RUNNER_ONLINE_WINDOW_MS = 45e3;
     TERMINAL_FLUSH_MS = 33;
     TERMINAL_FLUSH_BYTES = 16384;
+    TERMINAL_LOCAL_FLUSH_MS = 4;
     TERMINAL_RING_BYTES = 262144;
     TERMINAL_INPUT_MAX_BYTES = 65536;
     TERMINAL_REPLAY_PART_BYTES = 65536;
@@ -30,6 +57,19 @@ var init_constants = __esm({
     TERMINAL_MAX_PER_OWNER = 8;
     TERMINAL_MAX_PER_RUNNER = 32;
     TERMINAL_KILL_GRACE_MS = 2e3;
+    LOCAL_PORT_MIN = 47831;
+    LOCAL_PORT_MAX = 47850;
+    LOCAL_TOKEN_CACHE_MS = 3e5;
+    LOCAL_TOKEN_NEGATIVE_CACHE_MS = 1e4;
+    LOCAL_RECHECK_MS = LOCAL_TOKEN_CACHE_MS;
+    LOCAL_HANDSHAKE_TIMEOUT_MS = 5e3;
+    LOCAL_MAX_FRAME_BYTES = 262144;
+    LOCAL_MAX_PENDING_UPGRADES = 8;
+    LOCAL_MAX_SOCKETS_PER_USER = 4;
+    LOCAL_MAX_SOCKETS = 16;
+    LOCAL_MAX_CONNECTIONS = 32;
+    LOCAL_GETUSER_PER_MINUTE = 60;
+    LOCAL_MAX_PENDING_CMDS = 256;
   }
 });
 
@@ -487,34 +527,104 @@ var init_events = __esm({
   }
 });
 
-// ../../packages/shared/src/protocol/runner.ts
+// ../../packages/shared/src/protocol/local.ts
 import { z as z7 } from "zod";
+function parseLocalTopic(topic) {
+  const m = LOCAL_TOPIC_RE.exec(topic);
+  if (!m?.[1] || !m[2]) return null;
+  return { kind: m[1], id: m[2] };
+}
+function localProofMessage(nonce, runnerId, origin) {
+  return utf82.encode(`cayenne-local-v1
+${nonce}
+${runnerId}
+${origin}`);
+}
+var LOCAL_HEALTH_PATH, LOCAL_WS_PATH, LOCAL_CLOSE_NOT_READY, LOCAL_CLOSE_BAD_HANDSHAKE, LOCAL_CLOSE_UNAUTHORIZED, LOCAL_CLOSE_TOO_MANY, Base64Url, UUID, LOCAL_TOPIC_RE, LOCAL_SESSION_TOPIC_RE, LocalTopic, LocalSessionTopic, LocalHealth, utf82, LocalClientFrame, LocalRunnerFrame;
+var init_local = __esm({
+  "../../packages/shared/src/protocol/local.ts"() {
+    "use strict";
+    init_command();
+    init_events();
+    init_terminal();
+    LOCAL_HEALTH_PATH = "/health";
+    LOCAL_WS_PATH = "/ws";
+    LOCAL_CLOSE_NOT_READY = 1013;
+    LOCAL_CLOSE_BAD_HANDSHAKE = 4400;
+    LOCAL_CLOSE_UNAUTHORIZED = 4401;
+    LOCAL_CLOSE_TOO_MANY = 4429;
+    Base64Url = z7.string().regex(/^[A-Za-z0-9_-]+$/);
+    UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+    LOCAL_TOPIC_RE = new RegExp(`^(session|terminal):(${UUID})$`);
+    LOCAL_SESSION_TOPIC_RE = new RegExp(`^session:${UUID}$`);
+    LocalTopic = z7.string().regex(LOCAL_TOPIC_RE);
+    LocalSessionTopic = z7.string().regex(LOCAL_SESSION_TOPIC_RE);
+    LocalHealth = z7.object({
+      runnerId: z7.uuid(),
+      protocolVersion: z7.number().int(),
+      version: z7.string()
+    });
+    utf82 = new TextEncoder();
+    LocalClientFrame = z7.discriminatedUnion("t", [
+      z7.object({ t: z7.literal("hello"), nonce: Base64Url.length(43) }),
+      z7.object({ t: z7.literal("auth"), token: z7.string().min(1).max(8192) }),
+      z7.object({ t: z7.literal("cmd"), id: z7.uuid() }),
+      z7.object({ t: z7.literal("term"), terminalId: z7.uuid(), m: TerminalClientMessage }),
+      z7.object({ t: z7.literal("sub"), topic: LocalTopic }),
+      z7.object({ t: z7.literal("unsub"), topic: LocalTopic })
+    ]);
+    LocalRunnerFrame = z7.discriminatedUnion("t", [
+      z7.object({
+        t: z7.literal("hello"),
+        runnerId: z7.uuid(),
+        protocolVersion: z7.number().int(),
+        sig: Base64Url.length(86)
+      }),
+      z7.object({ t: z7.literal("ready"), userId: z7.uuid() }),
+      z7.object({ t: z7.literal("ack"), id: z7.uuid() }),
+      z7.object({
+        t: z7.literal("res"),
+        id: z7.uuid(),
+        status: CommandStatus.extract(["done", "failed", "cancelled"]),
+        result: z7.unknown().nullable(),
+        error: z7.string().nullable()
+      }),
+      z7.object({ t: z7.literal("cmd.err"), id: z7.uuid(), error: z7.string() }),
+      z7.object({ t: z7.literal("evt"), topic: LocalSessionTopic, e: SessionEvent }),
+      z7.object({ t: z7.literal("term"), terminalId: z7.uuid(), m: TerminalRunnerMessage }),
+      z7.object({ t: z7.literal("sub.err"), topic: LocalTopic, error: z7.string() })
+    ]);
+  }
+});
+
+// ../../packages/shared/src/protocol/runner.ts
+import { z as z8 } from "zod";
 var ProviderModel, ProviderCapability, UNAVAILABLE, RunnerCapabilities, CODEX_TOOL_NAMES;
 var init_runner = __esm({
   "../../packages/shared/src/protocol/runner.ts"() {
     "use strict";
     init_command();
-    ProviderModel = z7.object({
-      id: z7.string().min(1).max(200),
-      label: z7.string().min(1).max(200),
-      default: z7.boolean().optional(),
+    ProviderModel = z8.object({
+      id: z8.string().min(1).max(200),
+      label: z8.string().min(1).max(200),
+      default: z8.boolean().optional(),
       /** From the app-server's `supportedReasoningEfforts`; empty means the control is hidden. */
-      efforts: z7.array(Effort).default([]),
+      efforts: z8.array(Effort).default([]),
       /** The effort a new chat on this model opens at, sent back on `session.start`. */
       defaultEffort: Effort.optional()
     });
-    ProviderCapability = z7.object({
-      available: z7.boolean(),
-      reason: z7.enum(["not_installed", "not_logged_in", "error"]).optional(),
-      version: z7.string().max(50).optional(),
-      models: z7.array(ProviderModel).max(50).default([])
+    ProviderCapability = z8.object({
+      available: z8.boolean(),
+      reason: z8.enum(["not_installed", "not_logged_in", "error"]).optional(),
+      version: z8.string().max(50).optional(),
+      models: z8.array(ProviderModel).max(50).default([])
     });
     UNAVAILABLE = { available: false, reason: "not_installed", models: [] };
-    RunnerCapabilities = z7.object({
-      kinds: z7.array(z7.string()),
-      local_port: z7.number().int(),
-      claude: z7.boolean(),
-      providers: z7.object({
+    RunnerCapabilities = z8.object({
+      kinds: z8.array(z8.string()),
+      local_port: z8.number().int(),
+      claude: z8.boolean(),
+      providers: z8.object({
         claude: ProviderCapability.default({ available: true, models: [] }),
         codex: ProviderCapability.default(UNAVAILABLE)
       }).default({ claude: { available: true, models: [] }, codex: UNAVAILABLE }),
@@ -523,7 +633,13 @@ var init_runner = __esm({
        * config `allowMemberTerminals` names (protocol §9). Absent reads as none; a workspace admin
        * cannot grant a terminal. Optional so an older row still parses.
        */
-      memberTerminalIds: z7.array(z7.uuid()).max(64).optional()
+      memberTerminalIds: z8.array(z8.uuid()).max(64).optional(),
+      /**
+       * The raw Ed25519 public key of the running process (32 bytes, unpadded base64url), which signs
+       * the local server's `hello` (protocol §6.2). New on every start, republished by every capabilities refresh that changes the row;
+       * a client that finds it absent never opens the fast path. Optional so an older row still parses.
+       */
+      local_pubkey: z8.string().regex(/^[A-Za-z0-9_-]{43}$/).optional()
     });
     CODEX_TOOL_NAMES = {
       command: "codex.command_execution",
@@ -550,6 +666,7 @@ var init_protocol = __esm({
     init_events();
     init_git();
     init_github();
+    init_local();
     init_runner();
     init_terminal();
     init_transport();
@@ -652,31 +769,6 @@ var init_claude_dir = __esm({
   }
 });
 
-// src/cloud.ts
-function assertPublishable(key) {
-  if (!key) return key;
-  if (key.startsWith("sb_secret_"))
-    throw new Error("CLOUD key is a secret key; bake the publishable key");
-  if (key.startsWith("sb_publishable_")) return key;
-  const payload = key.split(".")[1];
-  if (!payload) throw new Error("CLOUD key is not a recognised Supabase key");
-  const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-  if (claims.role !== "anon") {
-    throw new Error(`CLOUD key has role "${claims.role}"; only the anon key may be baked in`);
-  }
-  return key;
-}
-var CLOUD_SUPABASE_URL, CLOUD_SUPABASE_ANON_KEY;
-var init_cloud = __esm({
-  "src/cloud.ts"() {
-    "use strict";
-    CLOUD_SUPABASE_URL = "https://ndqrkqxwkzxgnhkvcunr.supabase.co";
-    CLOUD_SUPABASE_ANON_KEY = assertPublishable(
-      "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im5kcXJrcXh3a3p4Z25oa3ZjdW5yIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODg3MTMyNzYsImV4cCI6MjEwNDI4OTI3Nn0.Dlsxw91E1QYZ4eoRDjP80Rf4feY77Z-T-fiIwUDY2k0"
-    );
-  }
-});
-
 // src/profile.ts
 import { join as join2 } from "path";
 function assertProfileName(name) {
@@ -725,7 +817,7 @@ import {
 } from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname, isAbsolute as isAbsolute2, join as join3 } from "path";
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 function setProfileOverride(name) {
   profileOverride = name;
 }
@@ -800,22 +892,24 @@ var init_config = __esm({
     init_cloud();
     init_profile();
     MEMBER_TERMINALS_ERROR = "allowMemberTerminals must be false or a list of user ids";
-    RunnerConfig = z8.object({
-      supabaseUrl: z8.url(),
-      supabaseAnonKey: z8.string().min(1),
-      workspaceId: z8.uuid().optional(),
-      runnerId: z8.uuid().optional(),
-      name: z8.string().optional(),
-      roots: z8.array(z8.string()).default([]),
-      port: z8.number().int().default(LOCAL_PORT),
-      allowBypassPermissions: z8.boolean().default(false),
+    RunnerConfig = z9.object({
+      supabaseUrl: z9.url(),
+      supabaseAnonKey: z9.string().min(1),
+      workspaceId: z9.uuid().optional(),
+      runnerId: z9.uuid().optional(),
+      name: z9.string().optional(),
+      roots: z9.array(z9.string()).default([]),
+      port: z9.number().int().default(LOCAL_PORT),
+      /** Extra page origins the local server admits, beside the built-in list (`buildOrigins`). */
+      localOrigins: z9.array(z9.string()).default([]),
+      allowBypassPermissions: z9.boolean().default(false),
       /** Absolute path to the `codex` binary, when it is not on the daemon's PATH. */
-      codexPath: z8.string().optional(),
+      codexPath: z9.string().optional(),
       /**
        * The Claude Code config directory this profile's sessions run on (D33), handed to them as
        * `CLAUDE_CONFIG_DIR`. Unset means the CLI's own default, `~/.claude`.
        */
-      claudeConfigDir: z8.string().optional(),
+      claudeConfigDir: z9.string().optional(),
       /**
        * Who besides the runner owner may hold a terminal here (D34, plan ruling 14): `false`, or the
        * user ids this machine's owner names. Machine-local like `allowBypassPermissions`: a workspace
@@ -823,15 +917,15 @@ var init_config = __esm({
        * `true` is refused — there is no "every member" switch. A listed member's shell runs as this
        * machine's OS user; the env allowlist is not a boundary.
        */
-      allowMemberTerminals: z8.union(
+      allowMemberTerminals: z9.union(
         [
-          z8.literal(false),
-          z8.array(z8.uuid({ error: MEMBER_TERMINALS_ERROR }), { error: MEMBER_TERMINALS_ERROR }).max(64, { error: MEMBER_TERMINALS_ERROR })
+          z9.literal(false),
+          z9.array(z9.uuid({ error: MEMBER_TERMINALS_ERROR }), { error: MEMBER_TERMINALS_ERROR }).max(64, { error: MEMBER_TERMINALS_ERROR })
         ],
         { error: MEMBER_TERMINALS_ERROR }
       ).default(false),
       /** Minutes a terminal nobody attends stays alive before the runner kills it (features §2). */
-      terminalIdleMinutes: z8.number().int().min(1).max(1440).default(10)
+      terminalIdleMinutes: z9.number().int().min(1).max(1440).default(10)
     });
     memberTerminalIdsOf = (cfg) => cfg.allowMemberTerminals === false ? [] : [...cfg.allowMemberTerminals];
     configPath = (dir) => join3(dir, "config.json");
@@ -911,24 +1005,12 @@ function grantedColumns(deps) {
     protocol_version: PROTOCOL_VERSION,
     status: "online",
     last_seen_at: (/* @__PURE__ */ new Date()).toISOString(),
-    // Spread: `deps.kinds` is the composer's list, not a value to hand to a serialiser that could
-    // mutate it. `claude: true` stays beside `providers`: clients written
-    // before this change look for it, and dropping it would read as "this runner cannot run
-    // Claude".
-    //
     // Parsed, not merely typed: this row is the writer and every client's `RunnerCapabilities`
     // parse is the reader. A value the reader rejects fails that parse *whole*, so one bad model
     // reads to a member as "my Mac cannot run Codex", with nothing said anywhere. Failing here is
-    // loud, on one machine, at the moment the value is produced.
-    capabilities: RunnerCapabilities.parse({
-      kinds: [...deps.kinds],
-      local_port: cfg.port,
-      claude: true,
-      providers: deps.providers,
-      // Who the runner's own config names (D34): the web shows `not-allowed` to anyone else
-      // instead of an "Open terminal" button the runner would refuse.
-      memberTerminalIds: memberTerminalIdsOf(cfg)
-    }),
+    // loud, on one machine, at the moment the value is produced. The parse also returns a copy, so
+    // the composer's arrays are never handed to a serialiser that could mutate them.
+    capabilities: RunnerCapabilities.parse(deps.capabilities),
     // The sandbox boundary from the config, resolved and never widened here.
     allowed_roots: publishedRoots(cfg.roots)
   };
@@ -1088,7 +1170,7 @@ import {
 } from "fs";
 import { uptime } from "os";
 import { join as join5 } from "path";
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function bootedAt(now = Date.now()) {
   return new Date(Math.round((now - uptime() * 1e3) / 1e3) * 1e3).toISOString();
 }
@@ -1231,13 +1313,13 @@ var LockRecord, BOOT_DRIFT_MS, ATTEMPTS, BACKOFF_MS, CLAIM_TTL_MS, errno, claimO
 var init_lock = __esm({
   "src/lock.ts"() {
     "use strict";
-    LockRecord = z9.object({
-      pid: z9.number().int().positive(),
-      profile: z9.string(),
-      startedAt: z9.string(),
+    LockRecord = z10.object({
+      pid: z10.number().int().positive(),
+      profile: z10.string(),
+      startedAt: z10.string(),
       /** `bootedAt()` when the lock was taken; a lock from another boot is stale whatever its pid. */
-      bootedAt: z9.string(),
-      version: z9.string()
+      bootedAt: z10.string(),
+      version: z10.string()
     });
     BOOT_DRIFT_MS = 1e4;
     ATTEMPTS = 8;
@@ -1339,6 +1421,44 @@ var init_version = __esm({
   }
 });
 
+// src/exec-path.ts
+import { accessSync, constants, statSync as statSync3 } from "fs";
+import { delimiter, isAbsolute as isAbsolute4, join as join8 } from "path";
+function findOnPath(name, path) {
+  for (const dir of (path ?? "").split(delimiter)) {
+    if (!isAbsolute4(dir)) continue;
+    const candidate = join8(dir, name);
+    try {
+      if (!statSync3(candidate).isFile()) continue;
+      accessSync(candidate, constants.X_OK);
+      return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function makeLocator(name, locate = findOnPath) {
+  const located = /* @__PURE__ */ new Map();
+  return {
+    find(path) {
+      const key = path ?? "";
+      const cached = located.get(key);
+      if (cached !== void 0) return cached;
+      const found = locate(name, path);
+      if (found !== null) located.set(key, found);
+      return found;
+    },
+    forget(path) {
+      located.delete(path ?? "");
+    }
+  };
+}
+var init_exec_path = __esm({
+  "src/exec-path.ts"() {
+    "use strict";
+  }
+});
+
 // src/codex/rpc.ts
 var RpcError, JsonRpc;
 var init_rpc = __esm({
@@ -1446,20 +1566,9 @@ var init_rpc = __esm({
 
 // src/codex/detect.ts
 import { execFile as execFile2, spawn } from "child_process";
-import { accessSync, constants } from "fs";
-import { delimiter, join as join8 } from "path";
 import { promisify } from "util";
 function findCodexOnPath(env) {
-  for (const dir of (env.PATH ?? "").split(delimiter)) {
-    if (!dir) continue;
-    const candidate = join8(dir, "codex");
-    try {
-      accessSync(candidate, constants.X_OK);
-      return candidate;
-    } catch {
-    }
-  }
-  return null;
+  return findOnPath("codex", env.PATH);
 }
 function resolveCodexPath(cfg, env, onPath) {
   return env.CAYENNE_CODEX_PATH ?? cfg.codexPath ?? onPath();
@@ -1536,6 +1645,7 @@ var init_detect = __esm({
   "src/codex/detect.ts"() {
     "use strict";
     init_src();
+    init_exec_path();
     init_rpc();
     exec = promisify(execFile2);
     PROBE_TIMEOUT_MS = 5e3;
@@ -1564,11 +1674,12 @@ var init_dispatcher = __esm({
 
 // src/commands/source.ts
 import { LRUCache } from "lru-cache";
-var byCreatedAt, GIT_READ_KINDS, GIT_WORKTREE_KINDS, laneOf, CommandSource;
+var STOPPING, byCreatedAt, GIT_READ_KINDS, GIT_WORKTREE_KINDS, laneOf, CommandSource;
 var init_source = __esm({
   "src/commands/source.ts"() {
     "use strict";
     init_src();
+    STOPPING = "runner stopping";
     byCreatedAt = (a, b) => Date.parse(a.created_at) - Date.parse(b.created_at) || a.id.localeCompare(b.id);
     GIT_READ_KINDS = /* @__PURE__ */ new Set(["git.status", "git.diff", "git.branches"]);
     GIT_WORKTREE_KINDS = /* @__PURE__ */ new Set([
@@ -1598,6 +1709,10 @@ var init_source = __esm({
       dispatch;
       log;
       seen = new LRUCache({ max: 1e3 });
+      /** Local-socket hooks per row id; dropped once fired, on `stop()`, or by the function `offer` returns. */
+      hooks = /* @__PURE__ */ new Map();
+      /** Rows between `enqueue` and their settlement: an `offer` for one of these registers hooks only. */
+      inflight = /* @__PURE__ */ new Set();
       queues = /* @__PURE__ */ new Map();
       channel = null;
       staleMs;
@@ -1664,6 +1779,38 @@ var init_source = __esm({
         this.pending = [];
         await this.draining;
         while (this.queues.size > 0) await Promise.allSettled([...this.queues.values()]);
+        for (const id of [...this.hooks.keys()]) this.dropHooks(id, STOPPING);
+      }
+      /**
+       * A pointer that arrived over the local socket (§6.2; SEC-P12, SP16). The same admission a
+       * broadcast gets — dedupe by id, conditional ack, the same lane — so a row the relay already
+       * delivered runs once, and a `terminal.open` pointer serialises behind the relay's copy in the
+       * `terminal:<id>` lane. Hooks are registered either way so the socket hears the outcome. A row
+       * this source already settled (or never claimed) is answered from the row itself, never from a
+       * guess (PR15). Returns the function that drops these hooks; the connection calls it on close.
+       */
+      offer(row, hooks) {
+        if (this.stopped) {
+          hooks.onDropped?.(STOPPING);
+          return () => {
+          };
+        }
+        const list = this.hooks.get(row.id) ?? [];
+        list.push(hooks);
+        this.hooks.set(row.id, list);
+        if (!this.seen.has(row.id)) {
+          if (this.draining) this.pending.push(row);
+          else this.enqueue(row);
+        } else if (!this.inflight.has(row.id)) {
+          void this.settleFromRow(row.id);
+        }
+        return () => {
+          const current = this.hooks.get(row.id);
+          if (!current) return;
+          const at = current.indexOf(hooks);
+          if (at >= 0) current.splice(at, 1);
+          if (current.length === 0) this.hooks.delete(row.id);
+        };
       }
       /**
        * Claim the row now; queue only its execution.
@@ -1681,6 +1828,7 @@ var init_source = __esm({
         if (this.stopped) return;
         if (this.seen.has(row.id)) return;
         this.seen.set(row.id, true);
+        this.inflight.add(row.id);
         const ageMs = this.now() - Date.parse(row.created_at);
         const admitted = this.admit(row, ageMs);
         const key = laneOf(row);
@@ -1707,6 +1855,7 @@ var init_source = __esm({
           if (row.flow_run_step_id === null && ageMs > this.staleMs) {
             const { error: error2 } = await this.finish(row.id, "cancelled", null, "STALE");
             if (error2) this.release(row.id, error2.message, "stale cancel failed");
+            else this.settle(row.id, { status: "cancelled", result: null, error: "STALE" });
             return "skip";
           }
           const { data, error } = await this.db.from("runner_commands").update({ status: "acked", acked_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", row.id).eq("status", "queued").select("id");
@@ -1716,8 +1865,10 @@ var init_source = __esm({
           }
           if (!data || data.length === 0) {
             this.log.info({ id: row.id }, "command no longer queued; not dispatching");
+            await this.settleFromRow(row.id);
             return "skip";
           }
+          for (const h of this.hooks.get(row.id) ?? []) h.onAck?.();
           return "dispatch";
         } catch (err) {
           this.release(row.id, err instanceof Error ? err.message : String(err), "ack failed");
@@ -1734,17 +1885,29 @@ var init_source = __esm({
        */
       release(id, err, msg) {
         this.seen.delete(id);
+        this.inflight.delete(id);
         this.log.warn({ id, err }, msg);
       }
       async run(row, admitted) {
         if (await admitted !== "dispatch") return;
+        let answered = false;
+        try {
+          await this.runAndFinish(row);
+          answered = true;
+        } finally {
+          if (!answered) await this.settleFromRow(row.id);
+        }
+      }
+      async runAndFinish(row) {
         let status = "done";
         let finished;
+        let result = null;
+        let message = null;
         try {
-          const result = await this.dispatch(row);
+          result = await this.dispatch(row);
           finished = await this.finish(row.id, "done", result ?? null, null);
         } catch (err) {
-          const message = err instanceof Error ? err.message : String(err);
+          message = err instanceof Error ? err.message : String(err);
           this.log.warn({ id: row.id, kind: row.kind, err: message }, "command failed");
           status = "failed";
           finished = await this.finish(row.id, status, null, message);
@@ -1755,6 +1918,52 @@ var init_source = __esm({
             "command finish write refused"
           );
         }
+        if (finished.error) await this.settleFromRow(row.id);
+        else {
+          this.settle(row.id, {
+            status,
+            result: status === "done" ? result ?? null : null,
+            error: status === "done" ? null : message
+          });
+        }
+      }
+      settle(id, r) {
+        this.inflight.delete(id);
+        const list = this.hooks.get(id);
+        if (!list) return;
+        this.hooks.delete(id);
+        for (const h of list) h.onFinished?.(r);
+      }
+      /**
+       * The outcome of a row this source did not finish itself — cancelled by its creator between the
+       * socket's read and our ack, claimed by another process, or settled before the pointer arrived.
+       * Read once; answered only when the row is terminal, otherwise the hooks are dropped and the
+       * client's relay wait sees the row (PR15: never invent a status).
+       */
+      async settleFromRow(id) {
+        this.inflight.delete(id);
+        if (!this.hooks.has(id)) return;
+        let reason = "row is not terminal";
+        try {
+          const { data } = await this.db.from("runner_commands").select("status, result, error").eq("id", id).maybeSingle();
+          const status = data?.status;
+          if (status === "done" || status === "failed" || status === "cancelled") {
+            this.settle(id, { status, result: data?.result ?? null, error: data?.error ?? null });
+            return;
+          }
+          if (!data) reason = "row not found";
+        } catch (err) {
+          this.log.warn({ id, err }, "could not re-read a command for its local pointer");
+          reason = "row re-read failed";
+        }
+        this.dropHooks(id, reason);
+      }
+      /** Hooks this source will never fire `onFinished` for: told so, so a socket frees its pending slot. */
+      dropHooks(id, reason) {
+        const list = this.hooks.get(id);
+        if (!list) return;
+        this.hooks.delete(id);
+        for (const h of list) h.onDropped?.(reason);
       }
       async finish(id, status, result, error) {
         const res = await this.db.from("runner_commands").update({ status, result, error, finished_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", id);
@@ -1766,7 +1975,7 @@ var init_source = __esm({
 
 // src/paths.ts
 import { lstatSync, realpathSync as realpathSync3 } from "fs";
-import { dirname as dirname3, isAbsolute as isAbsolute4, join as join9, relative, sep } from "path";
+import { dirname as dirname3, isAbsolute as isAbsolute5, join as join9, relative, sep } from "path";
 function assertInsideRoots(target, roots) {
   return resolveInsideRoots(target, roots).real;
 }
@@ -1784,7 +1993,7 @@ function resolveInsideRoots(target, roots) {
 }
 function assertInsideRootsOrAncestor(target, roots) {
   assertRoots(roots);
-  const absolute = isAbsolute4(target) ? target : `${process.cwd()}${sep}${target}`;
+  const absolute = isAbsolute5(target) ? target : `${process.cwd()}${sep}${target}`;
   let walked = walk(target, absolute);
   if (walked.tail.includes("..")) walked = walk(target, join9(walked.real, ...walked.tail));
   const checked = walked.tail.length === 0 ? walked.real : join9(walked.real, ...walked.tail);
@@ -1833,7 +2042,7 @@ function matchRoot(candidate, roots) {
       continue;
     }
     const rel = relative(rootReal, candidate);
-    const inside2 = rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
+    const inside2 = rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
     if (inside2 && (match === null || rootReal.length < match.length)) match = rootReal;
   }
   return match;
@@ -1847,7 +2056,7 @@ var init_paths = __esm({
 // src/git/introspect.ts
 import { execFile as execFile3 } from "child_process";
 import { readFileSync as readFileSync4, realpathSync as realpathSync4 } from "fs";
-import { delimiter as delimiter2, dirname as dirname4, isAbsolute as isAbsolute5, join as join10, resolve } from "path";
+import { delimiter as delimiter2, dirname as dirname4, isAbsolute as isAbsolute6, join as join10, resolve } from "path";
 import { promisify as promisify2 } from "util";
 function parseGitHubRemote(url) {
   const trimmed = url.trim();
@@ -1888,17 +2097,24 @@ function gitEnv(ceiling, env = process.env) {
   };
 }
 function makeGitRun(opts) {
+  const git = makeLocator("git", opts.locate);
   return async (args, cwd, ceiling) => {
+    const env = gitEnv(ceiling);
+    const file = git.find(env.PATH);
+    if (file === null) {
+      return { code: 127, stdout: "", stderr: "git not found on an absolute PATH entry" };
+    }
     try {
-      const { stdout, stderr } = await exec2("git", [...HARDENING, ...args], {
+      const { stdout, stderr } = await exec2(file, [...HARDENING, ...args], {
         cwd,
-        env: gitEnv(ceiling),
+        env,
         timeout: opts.timeoutMs,
         maxBuffer: GIT_MAX_BUFFER
       });
       return { code: 0, stdout, stderr };
     } catch (err) {
       const e = err;
+      if (e.code === "ENOENT") git.forget(env.PATH);
       return {
         code: typeof e.code === "number" ? e.code : 1,
         stdout: e.stdout ?? "",
@@ -1932,7 +2148,7 @@ function isLinkedWorktree(gitDir, commonDir, repoRoot) {
     return false;
   }
 }
-async function introspectRepo(cwd, run, root) {
+async function introspectRepo(cwd, run, root, { names = true } = {}) {
   try {
     const ceiling = dirname4(root);
     if (ceiling.includes(delimiter2)) return { ...NONE };
@@ -1950,16 +2166,16 @@ async function introspectRepo(cwd, run, root) {
     } catch {
       return { ...NONE };
     }
-    const head = await line(["rev-parse", "--abbrev-ref", "HEAD"]);
+    const head = names ? await line(["rev-parse", "--abbrev-ref", "HEAD"]) : null;
     const branch = head === "HEAD" ? null : head;
     const dirs = (await line(["rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"]))?.split("\n").map((d) => d.trim());
-    const [gitDir, commonDir] = dirs?.length === 2 && dirs.every((d) => isAbsolute5(d)) ? dirs.map((d) => canonical(d, cwd)) : [null, null];
+    const [gitDir, commonDir] = dirs?.length === 2 && dirs.every((d) => isAbsolute6(d)) ? dirs.map((d) => canonical(d, cwd)) : [null, null];
     if (commonDir == null || gitDir == null) return { ...NONE };
     if (!insideRoot(commonDir, root) && !isLinkedWorktree(gitDir, commonDir, repoRoot)) {
       return { ...NONE };
     }
     const isWorktree = gitDir !== commonDir;
-    const remote = await line(["remote", "get-url", "origin"]);
+    const remote = names ? await line(["remote", "get-url", "origin"]) : null;
     const gh = remote === null ? null : parseGitHubRemote(remote);
     return {
       repo_root: repoRoot,
@@ -1977,6 +2193,7 @@ var init_introspect = __esm({
   "src/git/introspect.ts"() {
     "use strict";
     init_src();
+    init_exec_path();
     init_paths();
     exec2 = promisify2(execFile3);
     GIT_TIMEOUT_MS = 5e3;
@@ -2016,10 +2233,10 @@ var init_introspect = __esm({
 });
 
 // src/git/commands.ts
-import { lstatSync as lstatSync2, realpathSync as realpathSync5, statSync as statSync3 } from "fs";
-import { dirname as dirname5, isAbsolute as isAbsolute6, join as join11, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
+import { lstatSync as lstatSync2, realpathSync as realpathSync5, statSync as statSync4 } from "fs";
+import { dirname as dirname5, isAbsolute as isAbsolute7, join as join11, relative as relative2, resolve as resolve2, sep as sep2 } from "path";
 async function scopeRepo(cwd, run, root) {
-  const identity = await introspectRepo(cwd, run, root);
+  const identity = await introspectRepo(cwd, run, root, { names: false });
   if (identity.repo_root === null) {
     throw new Error(`VALIDATION: ${cwd} is not inside a git repository under an allowed root`);
   }
@@ -2175,7 +2392,7 @@ async function gitDirs(scope, run) {
   );
   if (r.code !== 0) return null;
   const lines = r.stdout.split("\n").filter((l) => l !== "");
-  if (lines.length === 0 || !lines.every((l) => isAbsolute6(l))) return null;
+  if (lines.length === 0 || !lines.every((l) => isAbsolute7(l))) return null;
   try {
     return lines.map((l) => realpathSync5.native(l));
   } catch {
@@ -2189,7 +2406,7 @@ function isGitDirShape(dir) {
   if (commondir?.isFile()) return true;
   const isDir = (name) => {
     try {
-      return statSync3(join11(dir, name), { throwIfNoEntry: false })?.isDirectory() === true;
+      return statSync4(join11(dir, name), { throwIfNoEntry: false })?.isDirectory() === true;
     } catch {
       return false;
     }
@@ -2206,13 +2423,13 @@ function enclosesHome(repoRoot, home) {
   if (within(real, repoRoot)) return true;
   let root;
   try {
-    root = statSync3(repoRoot, { bigint: true });
+    root = statSync4(repoRoot, { bigint: true });
   } catch {
     return false;
   }
   for (let cur = real; ; cur = dirname5(cur)) {
     try {
-      const st = statSync3(cur, { bigint: true, throwIfNoEntry: false });
+      const st = statSync4(cur, { bigint: true, throwIfNoEntry: false });
       if (st && st.dev === root.dev && st.ino === root.ino) return true;
     } catch {
     }
@@ -2224,7 +2441,7 @@ function protectedTest(paths) {
   for (const path of paths) {
     try {
       const real = realpathSync5.native(path);
-      const st = statSync3(real, { bigint: true });
+      const st = statSync4(real, { bigint: true });
       entries.push({ real, dev: st.dev, ino: st.ino });
     } catch {
     }
@@ -2236,7 +2453,7 @@ function protectedTest(paths) {
     if (cached !== void 0) return cached;
     let hit = false;
     try {
-      const st = statSync3(path, { bigint: true, throwIfNoEntry: false });
+      const st = statSync4(path, { bigint: true, throwIfNoEntry: false });
       hit = st !== void 0 && entries.some((e) => e.dev === st.dev && e.ino === st.ino);
     } catch {
     }
@@ -2406,11 +2623,11 @@ import {
   openSync,
   readFileSync as readFileSync5,
   realpathSync as realpathSync6,
-  statSync as statSync4,
+  statSync as statSync5,
   writeSync
 } from "fs";
 import { readdir } from "fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute7, join as join12, relative as relative3, sep as sep3 } from "path";
+import { dirname as dirname6, isAbsolute as isAbsolute8, join as join12, relative as relative3, sep as sep3 } from "path";
 import { setImmediate } from "timers/promises";
 function worktreePathFor(repoRoot, name) {
   return join12(repoRoot, WORKTREES_DIR, name);
@@ -2435,7 +2652,7 @@ async function excludeCayenneDir(scope, run) {
     scope.ceiling
   );
   const common = r.stdout.trim();
-  if (r.code !== 0 || !isAbsolute7(common)) return;
+  if (r.code !== 0 || !isAbsolute8(common)) return;
   const dotGit = join12(scope.repoRoot, ".git");
   let dotGitIsRealDir;
   try {
@@ -2587,9 +2804,9 @@ async function worktreeIdentity(scope, run) {
     scope.ceiling
   );
   const gitDir = r.stdout.trim();
-  if (r.code !== 0 || !isAbsolute7(gitDir)) throw failed2("git rev-parse --git-dir", r.stderr);
+  if (r.code !== 0 || !isAbsolute8(gitDir)) throw failed2("git rev-parse --git-dir", r.stderr);
   try {
-    const st = statSync4(realpathSync6.native(gitDir), { bigint: true });
+    const st = statSync5(realpathSync6.native(gitDir), { bigint: true });
     return {
       gitDirDev: st.dev.toString(),
       gitDirIno: st.ino.toString(),
@@ -2624,7 +2841,7 @@ async function removeWorktree(scope, run, worktreePath, force) {
     throw new Error(`ROOT_NOT_ALLOWED: ${real}`);
   }
   const rel = relative3(base, real);
-  if (rel === "" || rel.startsWith("..") || isAbsolute7(rel) || rel.includes("/")) {
+  if (rel === "" || rel.startsWith("..") || isAbsolute8(rel) || rel.includes("/")) {
     throw new Error(`VALIDATION: ${worktreePath} is not under ${base}`);
   }
   const inside2 = `${real}${sep3}`;
@@ -2748,7 +2965,7 @@ var init_worktree_owners = __esm({
 import { rmSync as rmSync4 } from "fs";
 import { join as join14 } from "path";
 function createSessionWorktrees(dir) {
-  const fileFor = (sessionId) => UUID.test(sessionId) ? join14(dir, `${sessionId}.json`) : null;
+  const fileFor = (sessionId) => UUID2.test(sessionId) ? join14(dir, `${sessionId}.json`) : null;
   return {
     record(rec) {
       const file = fileFor(rec.sessionId);
@@ -2784,12 +3001,620 @@ function createSessionWorktrees(dir) {
     }
   };
 }
-var UUID;
+var UUID2;
 var init_session_worktrees = __esm({
   "src/git/session-worktrees.ts"() {
     "use strict";
     init_worktree_owners();
-    UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  }
+});
+
+// src/local/auth.ts
+import { createHash as createHash2 } from "crypto";
+import { LRUCache as LRUCache2 } from "lru-cache";
+function claimsOf(token) {
+  const payload = token.split(".")[1];
+  if (!payload) return null;
+  try {
+    const c = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    return typeof c.sub === "string" && typeof c.exp === "number" ? { sub: c.sub, exp: c.exp } : null;
+  } catch {
+    return null;
+  }
+}
+function retryable(error) {
+  const { name, status } = error;
+  if (name === "AuthRetryableFetchError") return true;
+  if (typeof status !== "number" || status === 0) return true;
+  return status >= 500 || status === 429;
+}
+function createTokenVerifier({
+  db,
+  ttlMs = LOCAL_TOKEN_CACHE_MS,
+  negativeTtlMs = LOCAL_TOKEN_NEGATIVE_CACHE_MS,
+  now = Date.now,
+  admit = () => true,
+  log
+}) {
+  const cache = new LRUCache2({ max: 1024 });
+  const key = (token) => createHash2("sha256").update(token).digest("hex");
+  let windowStart = now();
+  let calls = 0;
+  let warned2 = false;
+  const budgeted = () => {
+    const t = now();
+    if (t - windowStart >= 6e4) {
+      windowStart = t;
+      calls = 0;
+      warned2 = false;
+    }
+    if (calls < LOCAL_GETUSER_PER_MINUTE) {
+      calls += 1;
+      return true;
+    }
+    if (!warned2) {
+      warned2 = true;
+      log?.warn(
+        { perMinute: LOCAL_GETUSER_PER_MINUTE },
+        "local token verification over budget; refusing until the minute turns"
+      );
+    }
+    return false;
+  };
+  const refuse = (k) => {
+    cache.set(k, { userId: null, exp: 0, until: now() + negativeTtlMs });
+    return { status: "refused" };
+  };
+  return {
+    cacheKeys: () => [...cache.keys()],
+    async verify(token) {
+      const k = key(token);
+      const hit = cache.get(k);
+      if (hit && hit.until > now()) {
+        if (hit.userId === null) return { status: "refused" };
+        if (hit.exp * 1e3 <= now()) return refuse(k);
+        return { status: "valid", userId: hit.userId, exp: hit.exp };
+      }
+      cache.delete(k);
+      const claims = claimsOf(token);
+      if (!claims || claims.exp * 1e3 <= now() || !admit(claims.sub)) return refuse(k);
+      if (!budgeted()) return { status: "unavailable" };
+      const user = await db.auth.getUser(token).then(
+        (r) => r.error ? retryable(r.error) ? void 0 : null : r.data.user,
+        () => void 0
+      );
+      if (user === void 0) return { status: "unavailable" };
+      if (!user || user.id !== claims.sub) return refuse(k);
+      cache.set(k, { userId: user.id, exp: claims.exp, until: now() + ttlMs });
+      return { status: "valid", userId: user.id, exp: claims.exp };
+    }
+  };
+}
+var init_auth = __esm({
+  "src/local/auth.ts"() {
+    "use strict";
+    init_src();
+  }
+});
+
+// src/local/identity.ts
+import { generateKeyPairSync, sign } from "crypto";
+function createLocalIdentity() {
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+  const x = publicKey.export({ format: "jwk" }).x;
+  if (typeof x !== "string" || x.length !== 43) throw new Error("ed25519 public key export failed");
+  return {
+    publicKey: x,
+    sign: (message) => sign(null, message, privateKey).toString("base64url")
+  };
+}
+var init_identity = __esm({
+  "src/local/identity.ts"() {
+    "use strict";
+  }
+});
+
+// src/local/origins.ts
+function normalise(origin) {
+  try {
+    const u = new URL(origin);
+    if (u.username || u.password) return null;
+    return u.origin !== "null" ? u.origin.toLowerCase() : `${u.protocol}//${u.host}`.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function buildOrigins(extra, cloudOrigin = CLOUD_APP_ORIGIN) {
+  const builtIn = cloudOrigin ? [cloudOrigin, ...SHELLS] : [...DEV, ...SHELLS];
+  const out = /* @__PURE__ */ new Set();
+  for (const o of [...builtIn, ...extra]) {
+    const n = normalise(o);
+    if (n) out.add(n);
+  }
+  return [...out];
+}
+function originAllowed(origin, allowed) {
+  if (!origin) return false;
+  const n = normalise(origin);
+  return n !== null && allowed.includes(n);
+}
+var SHELLS, DEV;
+var init_origins = __esm({
+  "src/local/origins.ts"() {
+    "use strict";
+    init_cloud();
+    SHELLS = ["capacitor://localhost", "app://cayenne"];
+    DEV = ["http://localhost:5173", "http://127.0.0.1:5173"];
+  }
+});
+
+// src/local/connection.ts
+import { randomUUID as randomUUID2 } from "crypto";
+function closeSoon(ws, code, reason) {
+  if (ws.readyState === ws.CLOSED) return;
+  ws.close(code, reason);
+  const timer = setTimeout(() => ws.terminate(), CLOSE_GRACE_MS);
+  timer.unref();
+  ws.once("close", () => clearTimeout(timer));
+}
+function parseFrame(data) {
+  try {
+    const parsed = LocalClientFrame.safeParse(JSON.parse(String(data)));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+function handleConnection(ws, who, ctx, log, now) {
+  const sessions = /* @__PURE__ */ new Set();
+  const terminals = /* @__PURE__ */ new Set();
+  const pending = /* @__PURE__ */ new Map();
+  let closed = false;
+  const pendingSubs = /* @__PURE__ */ new Map();
+  const conn = {
+    id: randomUUID2(),
+    userId: who.userId,
+    tokenExp: who.tokenExp,
+    sessions,
+    terminals,
+    send(frame) {
+      if (ws.readyState !== ws.OPEN) return;
+      if (ws.bufferedAmount > MAX_BUFFERED_BYTES) {
+        log.warn({ conn: conn.id, userId: conn.userId }, "local client is not reading; closing");
+        closeSoon(ws, LOCAL_CLOSE_NOT_READY, "too far behind");
+        return;
+      }
+      ws.send(JSON.stringify(frame));
+    },
+    close(code, reason) {
+      closeSoon(ws, code, reason);
+    },
+    recheckSessions: () => recheckSessions()
+  };
+  const cmdErr = (id, error) => conn.send({ t: "cmd.err", id, error });
+  const onCmd = async (id) => {
+    if (pending.has(id)) return;
+    if (pending.size >= LOCAL_MAX_PENDING_CMDS) {
+      return cmdErr(id, "VALIDATION: too many pending commands on this socket");
+    }
+    pending.set(id, () => {
+    });
+    let row;
+    try {
+      row = await ctx.readRow(id);
+    } catch (err) {
+      pending.delete(id);
+      log.warn({ conn: conn.id, id, err }, "local cmd: row read failed");
+      return cmdErr(id, "PROVIDER_ERROR: could not read the command");
+    }
+    if (closed) return;
+    if (!row || row.runner_id !== ctx.runnerId || row.created_by !== conn.userId) {
+      const reason = !row ? "no row" : row.runner_id !== ctx.runnerId ? "another runner" : "another creator";
+      pending.delete(id);
+      log.info({ conn: conn.id, userId: conn.userId, id, reason }, "local cmd refused");
+      return cmdErr(id, "VALIDATION: no such command on this runner");
+    }
+    if (row.status === "done" || row.status === "failed" || row.status === "cancelled") {
+      pending.delete(id);
+      return conn.send({ t: "res", id, status: row.status, result: row.result, error: row.error });
+    }
+    const drop = ctx.source.offer(row, {
+      onAck: () => conn.send({ t: "ack", id }),
+      onFinished: (r) => {
+        pending.delete(id);
+        conn.send({ t: "res", id, ...r });
+      },
+      // The source will never settle this pointer (the row is claimed elsewhere and still running,
+      // or could not be re-read): free the slot and say so without settling (ruling B10, R-B6).
+      onDropped: (reason) => {
+        pending.delete(id);
+        log.info({ conn: conn.id, userId: conn.userId, id, reason }, "local cmd pointer dropped");
+        cmdErr(id, "VALIDATION: no such command on this runner");
+      }
+    });
+    if (pending.has(id)) pending.set(id, drop);
+  };
+  const onAuth = async (token) => {
+    const next = await ctx.verifier.verify(token);
+    if (next.status === "unavailable") {
+      log.info({ conn: conn.id, userId: conn.userId }, "local auth refresh unverified; kept");
+      return;
+    }
+    if (next.status !== "valid" || next.userId !== conn.userId || expiresAt(next.exp) <= now() || !ctx.serves(next.userId)) {
+      conn.close(LOCAL_CLOSE_UNAUTHORIZED, "unauthorized");
+      return;
+    }
+    conn.tokenExp = expiresAt(next.exp);
+    conn.send({ t: "ready", userId: conn.userId });
+    await recheckSessions();
+  };
+  const SESSION_REFUSED = "SESSION_NOT_FOUND: not hosted on this runner";
+  const sessionRefusal = (s) => !s ? "no row" : s.runner_id !== ctx.runnerId ? "another runner" : s.owner_id !== conn.userId && s.visibility !== "workspace" ? "private" : null;
+  const recheckSessions = async () => {
+    await Promise.all(
+      [...sessions].map(async (id) => {
+        let s;
+        try {
+          s = await ctx.readSession(id);
+        } catch (err) {
+          log.warn({ conn: conn.id, sessionId: id, err }, "local sub recheck: session read failed");
+          return;
+        }
+        const reason = sessionRefusal(s);
+        if (!reason || !sessions.delete(id)) return;
+        log.info(
+          { conn: conn.id, userId: conn.userId, sessionId: id, reason },
+          "local sub revoked"
+        );
+        conn.send({ t: "sub.err", topic: `session:${id}`, error: SESSION_REFUSED });
+      })
+    );
+  };
+  const onSub = async (topic) => {
+    const parsed = parseLocalTopic(topic);
+    if (!parsed) return;
+    if (parsed.kind === "session") {
+      const mine = {};
+      pendingSubs.set(parsed.id, mine);
+      const s = await ctx.readSession(parsed.id).catch(() => null);
+      if (closed || pendingSubs.get(parsed.id) !== mine) return;
+      pendingSubs.delete(parsed.id);
+      const reason = sessionRefusal(s);
+      if (reason) {
+        log.info(
+          { conn: conn.id, userId: conn.userId, sessionId: parsed.id, reason },
+          "local sub refused"
+        );
+        return conn.send({ t: "sub.err", topic, error: SESSION_REFUSED });
+      }
+      sessions.add(parsed.id);
+      return;
+    }
+    const t = ctx.terminals;
+    if (!t?.has(parsed.id) || t.ownerOf(parsed.id) !== conn.userId || !ctx.mayHoldTerminal(conn.userId)) {
+      return conn.send({
+        t: "sub.err",
+        topic,
+        error: "TERMINAL_NOT_FOUND: not your terminal here"
+      });
+    }
+    terminals.add(parsed.id);
+    t.attachLocal(parsed.id, conn.id);
+  };
+  const onUnsub = (topic) => {
+    const parsed = parseLocalTopic(topic);
+    if (!parsed) return;
+    if (parsed.kind === "session") {
+      sessions.delete(parsed.id);
+      pendingSubs.delete(parsed.id);
+    } else if (terminals.delete(parsed.id)) ctx.terminals?.detachLocal(parsed.id, conn.id);
+  };
+  const onTerm = (terminalId, m) => {
+    const t = ctx.terminals;
+    if (!t || !terminals.has(terminalId)) {
+      log.warn(
+        { conn: conn.id },
+        "local term frame for a terminal this socket is not subscribed to; dropped"
+      );
+      return;
+    }
+    try {
+      t.receive(terminalId, m.m, "local");
+    } catch (err) {
+      log.warn({ conn: conn.id, terminalId, err }, "local terminal message refused");
+    }
+  };
+  ws.on("message", (data) => {
+    const f = parseFrame(data);
+    if (!f) {
+      log.warn({ conn: conn.id }, "local frame did not parse");
+      return;
+    }
+    if (f.t === "hello") conn.close(LOCAL_CLOSE_BAD_HANDSHAKE, "handshake already done");
+    else if (f.t === "auth") void onAuth(f.token);
+    else if (f.t === "cmd") void onCmd(f.id);
+    else if (f.t === "sub") void onSub(f.topic);
+    else if (f.t === "unsub") onUnsub(f.topic);
+    else onTerm(f.terminalId, f);
+  });
+  ws.on("close", () => {
+    closed = true;
+    for (const id of terminals) ctx.terminals?.detachLocal(id, conn.id);
+    for (const drop of pending.values()) drop();
+    pending.clear();
+    terminals.clear();
+    sessions.clear();
+    pendingSubs.clear();
+  });
+  return conn;
+}
+function sessionFrame(sessionId, e) {
+  return { t: "evt", topic: `session:${sessionId}`, e };
+}
+var MAX_BUFFERED_BYTES, CLOSE_GRACE_MS, expiresAt;
+var init_connection = __esm({
+  "src/local/connection.ts"() {
+    "use strict";
+    init_src();
+    MAX_BUFFERED_BYTES = 4 * 1024 * 1024;
+    CLOSE_GRACE_MS = 250;
+    expiresAt = (exp) => exp * 1e3;
+  }
+});
+
+// src/local/server.ts
+import { createServer } from "http";
+import { WebSocketServer } from "ws";
+function createLocalServer({
+  port,
+  origins,
+  log,
+  handshakeTimeoutMs = LOCAL_HANDSHAKE_TIMEOUT_MS,
+  recheckMs = LOCAL_RECHECK_MS,
+  now = Date.now,
+  maxSockets = LOCAL_MAX_SOCKETS
+}) {
+  let ctx = null;
+  let bound = null;
+  const conns = /* @__PURE__ */ new Set();
+  let pendingUpgrades = 0;
+  const wss = new WebSocketServer({ noServer: true, maxPayload: LOCAL_MAX_FRAME_BYTES });
+  let untapTerminals = null;
+  let unwatchRoster = null;
+  let recheckTimer = null;
+  const hostAllowed = (host) => bound !== null && (host === `${HOST}:${bound}` || host === `localhost:${bound}`);
+  const socketsOf = (userId) => {
+    let n = 0;
+    for (const c of conns) if (c.userId === userId) n += 1;
+    return n;
+  };
+  const recheck = () => {
+    const current = ctx;
+    if (!current) return;
+    const t = now();
+    for (const c of [...conns]) {
+      if (!current.serves(c.userId) || t >= c.tokenExp) {
+        c.close(LOCAL_CLOSE_UNAUTHORIZED, "no longer authorised");
+      } else {
+        void c.recheckSessions();
+      }
+    }
+  };
+  const cors = (req, res) => {
+    const origin = req.headers.origin;
+    if (!originAllowed(origin, origins)) return false;
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+    return true;
+  };
+  const server = createServer((req, res) => {
+    if (!hostAllowed(req.headers.host)) {
+      res.writeHead(403).end();
+      return;
+    }
+    if (req.url !== LOCAL_HEALTH_PATH) {
+      res.writeHead(404).end();
+      return;
+    }
+    const allowed = cors(req, res);
+    if (req.method === "OPTIONS") {
+      if (!allowed) {
+        res.writeHead(403).end();
+        return;
+      }
+      res.setHeader("Access-Control-Allow-Methods", "GET");
+      res.setHeader("Access-Control-Allow-Private-Network", "true");
+      res.setHeader("Access-Control-Max-Age", "600");
+      res.writeHead(204).end();
+      return;
+    }
+    if (req.method !== "GET") {
+      res.writeHead(405).end();
+      return;
+    }
+    res.setHeader("Content-Type", "application/json");
+    res.setHeader("Cache-Control", "no-store");
+    if (!ctx) {
+      res.writeHead(503).end(JSON.stringify({ error: "starting" }));
+      return;
+    }
+    res.writeHead(200).end(
+      JSON.stringify({
+        runnerId: ctx.runnerId,
+        protocolVersion: PROTOCOL_VERSION,
+        version: ctx.version
+      })
+    );
+  });
+  server.maxConnections = LOCAL_MAX_CONNECTIONS;
+  server.headersTimeout = LOCAL_HANDSHAKE_TIMEOUT_MS;
+  server.requestTimeout = LOCAL_HANDSHAKE_TIMEOUT_MS;
+  server.keepAliveTimeout = 1e3;
+  const refuse = (socket, status) => {
+    const text = status === 403 ? "Forbidden" : "Service Unavailable";
+    socket.write(`HTTP/1.1 ${status} ${text}\r
+Connection: close\r
+Content-Length: 0\r
+\r
+`);
+    socket.destroy();
+  };
+  server.on("upgrade", (req, socket, head) => {
+    const origin = req.headers.origin ?? "";
+    if (req.url !== LOCAL_WS_PATH || !hostAllowed(req.headers.host) || !originAllowed(origin, origins)) {
+      refuse(socket, 403);
+      return;
+    }
+    if (pendingUpgrades >= LOCAL_MAX_PENDING_UPGRADES || conns.size >= maxSockets) {
+      refuse(socket, 503);
+      return;
+    }
+    pendingUpgrades += 1;
+    let released = false;
+    const release = () => {
+      if (released) return;
+      released = true;
+      pendingUpgrades -= 1;
+    };
+    let ws = null;
+    const timer = setTimeout(() => {
+      if (ws) closeSoon(ws, LOCAL_CLOSE_NOT_READY, "handshake timeout");
+      else socket.destroy();
+    }, handshakeTimeoutMs);
+    socket.once("close", release);
+    wss.handleUpgrade(req, socket, head, (admitted) => {
+      ws = admitted;
+      admitted.on("close", release);
+      admitted.on("error", (err) => {
+        log.warn({ code: err.code }, "local socket error");
+      });
+      const current = ctx;
+      if (!current) {
+        clearTimeout(timer);
+        closeSoon(admitted, LOCAL_CLOSE_NOT_READY, "starting");
+        return;
+      }
+      let state = "awaiting-hello";
+      const onHandshake = async (data) => {
+        const f = parseFrame(data);
+        if (state === "awaiting-hello") {
+          if (f?.t !== "hello") {
+            closeSoon(admitted, LOCAL_CLOSE_BAD_HANDSHAKE, "expected hello");
+            return;
+          }
+          state = "awaiting-auth";
+          const sig = current.identity.sign(localProofMessage(f.nonce, current.runnerId, origin));
+          admitted.send(
+            JSON.stringify({
+              t: "hello",
+              runnerId: current.runnerId,
+              protocolVersion: PROTOCOL_VERSION,
+              sig
+            })
+          );
+          return;
+        }
+        if (state !== "awaiting-auth" || !f || f.t !== "auth") {
+          closeSoon(admitted, LOCAL_CLOSE_BAD_HANDSHAKE, "expected auth");
+          return;
+        }
+        state = "verifying";
+        const who = await current.verifier.verify(f.token);
+        if (admitted.readyState !== admitted.OPEN) return;
+        if (who.status !== "valid" || expiresAt(who.exp) <= now() || !current.serves(who.userId)) {
+          closeSoon(admitted, LOCAL_CLOSE_UNAUTHORIZED, "unauthorized");
+          return;
+        }
+        const tokenExp = expiresAt(who.exp);
+        if (socketsOf(who.userId) >= LOCAL_MAX_SOCKETS_PER_USER) {
+          closeSoon(admitted, LOCAL_CLOSE_TOO_MANY, "too many sockets for this user");
+          return;
+        }
+        if (conns.size >= maxSockets) {
+          closeSoon(admitted, LOCAL_CLOSE_TOO_MANY, "too many sockets");
+          return;
+        }
+        state = "ready";
+        clearTimeout(timer);
+        release();
+        admitted.off("message", listener);
+        const conn = handleConnection(
+          admitted,
+          { userId: who.userId, tokenExp },
+          current,
+          log,
+          now
+        );
+        conns.add(conn);
+        admitted.on("close", () => conns.delete(conn));
+        conn.send({ t: "ready", userId: who.userId });
+        log.info({ conn: conn.id, userId: who.userId }, "local client attached");
+      };
+      const listener = (data) => {
+        void onHandshake(data);
+      };
+      admitted.on("message", listener);
+    });
+  });
+  return {
+    get port() {
+      return bound;
+    },
+    listen() {
+      return new Promise((resolve3, reject) => {
+        server.once("error", reject);
+        server.listen(port, HOST, () => {
+          server.off("error", reject);
+          const address = server.address();
+          bound = typeof address === "object" && address ? address.port : port;
+          log.info({ host: HOST, port: bound }, "local server listening");
+          resolve3(bound);
+        });
+      });
+    },
+    attach(next) {
+      ctx = next;
+      untapTerminals?.();
+      untapTerminals = next.terminals?.subscribe((terminalId, m, origin) => {
+        if (m.type === "replay" && origin === "relay") return;
+        for (const c of conns)
+          if (c.terminals.has(terminalId)) c.send({ t: "term", terminalId, m });
+      }) ?? null;
+      unwatchRoster?.();
+      unwatchRoster = next.onRosterRefresh(recheck);
+      if (recheckTimer) clearInterval(recheckTimer);
+      recheckTimer = setInterval(recheck, recheckMs);
+      recheckTimer.unref();
+    },
+    emit(sessionId, e) {
+      const frame = sessionFrame(sessionId, e);
+      for (const c of conns) if (c.sessions.has(sessionId)) c.send(frame);
+    },
+    close() {
+      if (recheckTimer) clearInterval(recheckTimer);
+      recheckTimer = null;
+      unwatchRoster?.();
+      unwatchRoster = null;
+      untapTerminals?.();
+      untapTerminals = null;
+      for (const client of wss.clients) client.close(1001, "runner stopping");
+      return new Promise((resolve3) => {
+        wss.close();
+        server.close(() => resolve3());
+        server.closeAllConnections();
+      });
+    }
+  };
+}
+var HOST;
+var init_server = __esm({
+  "src/local/server.ts"() {
+    "use strict";
+    init_src();
+    init_connection();
+    init_origins();
+    HOST = "127.0.0.1";
   }
 });
 
@@ -3030,21 +3855,31 @@ function checkRunsArgs(req, sha) {
   }
   return ["api", `repos/${req.owner}/${req.name}/commits/${sha}/check-runs`];
 }
-async function runGh(args) {
-  try {
-    const { stdout, stderr } = await exec3("gh", args, {
-      timeout: GH_TIMEOUT_MS,
-      maxBuffer: MAX_OUTPUT * 2
-    });
-    return { code: 0, stdout, stderr };
-  } catch (err) {
-    const e = err;
-    return {
-      code: typeof e.code === "number" ? e.code : 1,
-      stdout: e.stdout ?? "",
-      stderr: e.stderr ?? ""
-    };
-  }
+function makeGhRun(opts = {}) {
+  const gh = makeLocator("gh", opts.locate);
+  const currentPath = opts.path ?? (() => process.env.PATH);
+  return async (args) => {
+    const path = currentPath();
+    const file = gh.find(path);
+    if (file === null) {
+      return { code: 127, stdout: "", stderr: "gh not found on an absolute PATH entry" };
+    }
+    try {
+      const { stdout, stderr } = await exec3(file, args, {
+        timeout: GH_TIMEOUT_MS,
+        maxBuffer: MAX_OUTPUT * 2
+      });
+      return { code: 0, stdout, stderr };
+    } catch (err) {
+      const e = err;
+      if (e.code === "ENOENT") gh.forget(path);
+      return {
+        code: typeof e.code === "number" ? e.code : 1,
+        stdout: e.stdout ?? "",
+        stderr: e.stderr ?? ""
+      };
+    }
+  };
 }
 function statusFrom(stderr) {
   const m = /\(HTTP (\d{3})\)/.exec(stderr);
@@ -3082,16 +3917,18 @@ function createGhGateway(run) {
     }
   };
 }
-var exec3, GH_TIMEOUT_MS, MAX_OUTPUT, ALL_DOTS3, COMMIT_SHA;
+var exec3, GH_TIMEOUT_MS, MAX_OUTPUT, ALL_DOTS3, COMMIT_SHA, runGh;
 var init_gh = __esm({
   "src/github/gh.ts"() {
     "use strict";
     init_src();
+    init_exec_path();
     exec3 = promisify3(execFile4);
     GH_TIMEOUT_MS = 2e4;
     MAX_OUTPUT = 512e3;
     ALL_DOTS3 = /^\.+$/;
     COMMIT_SHA = /^[0-9a-f]{40}$/;
+    runGh = makeGhRun();
   }
 });
 
@@ -3307,11 +4144,11 @@ var init_handlers = __esm({
 
 // src/git/watch.ts
 import { watch } from "fs";
-import { isAbsolute as isAbsolute8, normalize, sep as sep4 } from "path";
+import { isAbsolute as isAbsolute9, normalize, sep as sep4 } from "path";
 function ignored(name) {
   if (name === null || name === "") return false;
   const rel = normalize(name);
-  if (isAbsolute8(rel) || rel === ".." || rel.startsWith(`..${sep4}`)) return true;
+  if (isAbsolute9(rel) || rel === ".." || rel.startsWith(`..${sep4}`)) return true;
   return rel.split(/[\\/]/).some((segment) => IGNORED_NAMES.has(segment));
 }
 function watchChanges(cwd, onChange, debounceMs = CHANGES_DEBOUNCE_MS, onError = () => void 0, fsWatch = recursiveWatch) {
@@ -3513,7 +4350,7 @@ var init_pushable = __esm({
 });
 
 // src/claude/session.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 import { EventEmitter } from "events";
 import { query as sdkQuery } from "@anthropic-ai/claude-agent-sdk";
 var ClaudeSession;
@@ -3621,7 +4458,7 @@ var init_session = __esm({
       }
       requestPermission(toolName2, input, suggestions, toolUseId, signal) {
         return new Promise((resolve3) => {
-          const id = randomUUID2();
+          const id = randomUUID3();
           const settle = (d) => {
             const entry = this.pending.get(id);
             if (!entry) return;
@@ -4160,9 +4997,9 @@ var init_create = __esm({
 });
 
 // src/sessions/manager.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import { realpathSync as realpathSync7 } from "fs";
-import { isAbsolute as isAbsolute9, sep as sep5 } from "path";
+import { isAbsolute as isAbsolute10, sep as sep5 } from "path";
 import { isDeepStrictEqual } from "util";
 function narrowToSession(suggestions) {
   if (!suggestions) return suggestions;
@@ -4320,7 +5157,7 @@ var init_manager = __esm({
         if (p.initialPrompt) {
           await this.prompt(
             sessionId,
-            { text: p.initialPrompt, clientUuid: randomUUID3(), attachments: [] },
+            { text: p.initialPrompt, clientUuid: randomUUID4(), attachments: [] },
             createdBy
           );
         }
@@ -4797,7 +5634,7 @@ var init_manager = __esm({
       }
       /** A path as the SDK reads it: relative means relative to the session's cwd. */
       fromCwd(cwd, value) {
-        return isAbsolute9(value) ? value : `${cwd}${sep5}${value}`;
+        return isAbsolute10(value) ? value : `${cwd}${sep5}${value}`;
       }
       /**
        * §2.9: a path in `updatedInput` passes the same boundary the session's `cwd` did, and the
@@ -5362,6 +6199,11 @@ var init_manager = __esm({
           }
           message = envelope(shrunk);
         }
+        try {
+          this.deps.tap?.(sessionId, message.payload);
+        } catch (err) {
+          this.deps.log.warn({ err, sessionId, type: event.type }, "session event tap threw");
+        }
         const result = await live.channel.send(message);
         if (result !== "ok") {
           this.deps.log.warn(
@@ -5476,7 +6318,7 @@ var init_channels = __esm({
 // src/terminal/env.ts
 import { readFileSync as readFileSync7, realpathSync as realpathSync8 } from "fs";
 import { lstat } from "fs/promises";
-import { dirname as dirname7, isAbsolute as isAbsolute10, relative as relative4 } from "path";
+import { dirname as dirname7, isAbsolute as isAbsolute11, relative as relative4 } from "path";
 function terminalEnv(base, { runnerOwner, claudeConfigDir }) {
   const env = {};
   for (const [key, value] of Object.entries(base)) {
@@ -5546,7 +6388,7 @@ function tryRealpath(fs, p) {
 }
 function inside(candidate, root) {
   const rel = relative4(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute10(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute11(rel);
 }
 var SECRET_ENV, MEMBER_ENV_ALLOW, MEMBER_ENV_KEYS, LOCALE_ENV, nodeShellFs;
 var init_env = __esm({
@@ -5753,6 +6595,7 @@ var init_manager2 = __esm({
       constructor(deps) {
         this.deps = deps;
         this.flushMs = deps.flushMs ?? TERMINAL_FLUSH_MS;
+        this.localFlushMs = deps.localFlushMs ?? TERMINAL_LOCAL_FLUSH_MS;
         this.flushBytes = deps.flushBytes ?? TERMINAL_FLUSH_BYTES;
         this.ringBytes = deps.ringBytes ?? TERMINAL_RING_BYTES;
         this.reaper = setInterval(() => this.reap(), deps.reapIntervalMs ?? TERMINAL_REAP_INTERVAL_MS);
@@ -5769,6 +6612,7 @@ var init_manager2 = __esm({
       opens = /* @__PURE__ */ new Set();
       reaper;
       flushMs;
+      localFlushMs;
       flushBytes;
       ringBytes;
       /** Set once by `shutdown()` (fix round 1 L7): `open()` checks it after every await. */
@@ -6092,9 +6936,14 @@ var init_manager2 = __esm({
           return;
         }
         if (term.flushTimer) return;
-        let others = 0;
-        for (const t of this.terms.values()) if (t.flushTimer !== null) others += 1;
-        const delay2 = others > 0 ? this.flushMs * 2 : this.flushMs;
+        let delay2 = this.localFlushMs;
+        if (!this.relaySuppressed(terminalId)) {
+          let others = 0;
+          for (const [id, t] of this.terms) {
+            if (t.flushTimer !== null && !this.relaySuppressed(id)) others += 1;
+          }
+          delay2 = others > 0 ? this.flushMs * 2 : this.flushMs;
+        }
         term.flushTimer = setTimeout(() => {
           term.flushTimer = null;
           this.flush(terminalId, term);
@@ -6635,9 +7484,36 @@ async function compose(cfg, lock, host, preflight) {
   const pty = await loadPty();
   const memberTerminalIds = memberTerminalIdsOf(cfg);
   const kinds2 = handledKinds({ terminal: pty !== null });
+  const localIdentity = createLocalIdentity();
+  const origins = buildOrigins(cfg.localOrigins);
+  if (CLOUD_SUPABASE_URL !== "" && CLOUD_APP_ORIGIN === "") {
+    logger.warn(
+      { origins },
+      "local origins: dev origins enabled because CAYENNE_CLOUD_APP_ORIGIN is empty"
+    );
+  }
+  logger.info({ origins }, "local origins");
+  const local = createLocalServer({ port: cfg.port, origins, log: logger });
+  let localPort = 0;
+  if (cfg.port < LOCAL_PORT_MIN || cfg.port > LOCAL_PORT_MAX) {
+    logger.warn(
+      { port: cfg.port },
+      `local port ${cfg.port} is outside ${LOCAL_PORT_MIN}\u2013${LOCAL_PORT_MAX}; fast path disabled for this run`
+    );
+  } else {
+    try {
+      localPort = await local.listen();
+    } catch (err) {
+      logger.warn(
+        { port: cfg.port, err: err instanceof Error ? err.message : String(err) },
+        "local server could not bind; fast path disabled for this run"
+      );
+    }
+  }
   const capabilities = () => ({
     kinds: [...kinds2],
-    local_port: cfg.port,
+    local_port: localPort,
+    local_pubkey: localIdentity.publicKey,
     claude: true,
     providers,
     // Who the runner's own config names (D34); every heartbeat refresh republishes it.
@@ -6654,17 +7530,27 @@ async function compose(cfg, lock, host, preflight) {
     }
     return capabilities();
   };
-  const identity = await registerRunner({
-    db,
-    cfg: registerAs === cfg.runnerId ? cfg : { ...cfg, runnerId: void 0 },
-    hostname: hostname(),
-    profile,
-    platform: `${process.platform}-${process.arch}`,
-    version: VERSION,
-    providers: registered.providers,
-    kinds: kinds2
-  });
-  lock.take(identity.runnerId);
+  let identity;
+  try {
+    identity = await registerRunner({
+      db,
+      cfg: registerAs === cfg.runnerId ? cfg : { ...cfg, runnerId: void 0 },
+      hostname: hostname(),
+      profile,
+      platform: `${process.platform}-${process.arch}`,
+      version: VERSION,
+      capabilities: registered
+    });
+  } catch (err) {
+    await local.close();
+    throw err;
+  }
+  try {
+    lock.take(identity.runnerId);
+  } catch (err) {
+    await local.close();
+    throw err;
+  }
   let stopHeartbeat = null;
   let roster = null;
   try {
@@ -6699,11 +7585,14 @@ async function compose(cfg, lock, host, preflight) {
       codexAvailable: () => providers.codex.available,
       claudeEnv: claudeEnv(claudeConfigDir),
       git,
-      log: logger
+      log: logger,
+      // Every session event also reaches the loopback sockets subscribed to it (Task 10a).
+      tap: (sessionId, event) => local.emit(sessionId, event)
     });
     let terminals;
+    let terminalManager = null;
     if (pty) {
-      const terminalManager = new TerminalManager({
+      const tm = new TerminalManager({
         pty,
         roots,
         env: process.env,
@@ -6726,16 +7615,17 @@ async function compose(cfg, lock, host, preflight) {
         memberTerminalIds,
         serves: (userId) => liveRoster.serves(userId),
         rosterHealthy: () => liveRoster.healthy(),
-        manager: terminalManager,
-        channels: createTerminalChannels({ db, manager: terminalManager, log: logger }),
+        manager: tm,
+        channels: createTerminalChannels({ db, manager: tm, log: logger }),
         log: logger
       });
       liveRoster.onRefresh(() => {
-        terminalManager.revalidate();
+        tm.revalidate();
         void service2.reconcileRows();
       });
       await service2.closeOpenRows();
       terminals = service2;
+      terminalManager = tm;
     }
     const dispatch = createDispatcher(
       buildHandlers(manager, {
@@ -6758,6 +7648,43 @@ async function compose(cfg, lock, host, preflight) {
     );
     stopHeartbeat = heartbeat;
     await source.start();
+    if (localPort !== 0) {
+      local.attach({
+        runnerId: identity.runnerId,
+        version: VERSION,
+        identity: localIdentity,
+        // R-B4: a token whose subject the roster does not serve (or whose payload is malformed or
+        // expired) is refused inside the verifier, before any GoTrue call — junk on the loopback
+        // port cannot rate-limit the real member's `/user` check.
+        verifier: createTokenVerifier({
+          db,
+          admit: (sub) => liveRoster.serves(sub),
+          log: logger
+        }),
+        // The roster's own predicate, read live: the owner while a member, listed members while
+        // still members (PR16); every refresh re-checks every socket (SEC-P2).
+        serves: (userId) => liveRoster.serves(userId),
+        onRosterRefresh: (cb) => liveRoster.onRefresh(cb),
+        // Exactly the manager's rule (ruling 14, R2-H1), built from the same deps it was given.
+        mayHoldTerminal: (userId) => mayHoldTerminal(userId, {
+          runnerUserId: identity.userId,
+          memberTerminalIds,
+          serves: (u) => liveRoster.serves(u),
+          rosterHealthy: () => liveRoster.healthy()
+        }),
+        source,
+        readRow: async (id) => {
+          const { data } = await db.from("runner_commands").select("*").eq("id", id).maybeSingle();
+          const parsed = CommandRow.safeParse(data);
+          return parsed.success ? parsed.data : null;
+        },
+        readSession: async (id) => {
+          const { data } = await db.from("chat_sessions").select("runner_id, owner_id, visibility").eq("id", id).maybeSingle();
+          return data;
+        },
+        terminals: terminalManager
+      });
+    }
     logger.info(
       {
         runnerId: identity.runnerId,
@@ -6792,6 +7719,7 @@ async function compose(cfg, lock, host, preflight) {
         await stage("terminals.shutdown", async () => {
           await terminals?.shutdown();
         });
+        await stage("local.close", () => local.close());
         await stage("roster.stop", () => liveRoster.stop());
         if (failures.length > 0) throw failures[0];
       } finally {
@@ -6858,6 +7786,7 @@ async function compose(cfg, lock, host, preflight) {
         "runner roster stop failed during a failed start"
       );
     }
+    await local.close().catch(() => void 0);
     await markOffline(db, identity.runnerId);
     throw err;
   }
@@ -6892,6 +7821,7 @@ var init_start = __esm({
     "use strict";
     init_src();
     init_claude_dir();
+    init_cloud();
     init_detect();
     init_dispatcher();
     init_source();
@@ -6899,6 +7829,10 @@ var init_start = __esm({
     init_ops();
     init_session_worktrees();
     init_worktree_owners();
+    init_auth();
+    init_identity();
+    init_origins();
+    init_server();
     init_lock();
     init_log();
     init_profile();
@@ -6944,6 +7878,9 @@ async function logout(db) {
   await db.auth.signOut();
 }
 
+// src/cli.ts
+init_cloud();
+
 // src/commands/doctor.ts
 async function probeBackend(url, anonKey, fetchFn = fetch) {
   try {
@@ -7022,6 +7959,19 @@ async function doctor(deps) {
       fix: TERMINAL_FIX
     }
   );
+  const devOriginsInPublishedBuild = deps.cloud.supabaseUrl !== "" && deps.cloud.appOrigin === "";
+  checks.push(
+    devOriginsInPublishedBuild ? {
+      name: "local origins",
+      ok: false,
+      detail: "local origins: dev origins enabled because CAYENNE_CLOUD_APP_ORIGIN is empty",
+      fix: "Rebuild the runner with CAYENNE_CLOUD_APP_ORIGIN set to the app origin (tsup.config.ts `define`)."
+    } : {
+      name: "local origins",
+      ok: true,
+      detail: deps.cloud.appOrigin || "source checkout: dev origins"
+    }
+  );
   return checks;
 }
 
@@ -7495,7 +8445,8 @@ program.command("doctor").description("Check the install and say how to fix what
     probe: (url) => probeBackend(url, backend?.anonKey ?? ""),
     runnerId,
     holder: runnerId ? holderOf({ root: cayenneHome(), runnerId }) : null,
-    pty: await loadPty() !== null
+    pty: await loadPty() !== null,
+    cloud: { appOrigin: CLOUD_APP_ORIGIN, supabaseUrl: CLOUD_SUPABASE_URL }
   });
   for (const c of checks) {
     console.log(`${c.ok ? "ok  " : "FAIL"} ${c.name}: ${c.detail}`);